Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 8e8134021d913057…

MALICIOUS

RTF / .DOC

4.9 KB First seen: 2022-03-29
MD5: 3b61417dd02903d7ad8ee4fa83e8d512 SHA-1: a1bf9ed4873273d7d1ae9c4c3242a566b3d5944e SHA-256: 8e8134021d91305733bbf33cc41e5f9f0325ddf861b65b0eebec79369c0228ec
121 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The RTF document contains embedded OLE objects, specifically triggering critical heuristics related to Equation Editor vulnerabilities. The \objupdate directive indicates that the embedded object will be activated automatically upon opening, leading to the exploitation of the Equation Editor. This is a common delivery mechanism for exploiting known vulnerabilities to achieve arbitrary code execution.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off00000097.bin
011e8d08b7181368f0799f294ef28d9dd486bba5cd8f75e715564a6db45b572a
rtf-objdata-decoded RTF \objdata at offset 0x97 2167 bytes